testing/cross_backend/testing_backdoor.ts

Cross-backend negative-credential suite for the _testing_* backdoor actions.

_testing_reset / _testing_mint_session / _testing_put_fact / _testing_schema_snapshot / _testing_migration_tracker / _testing_action_manifest are privileged test-binary actions the production wire never exposes — three direct DB writes (full auth wipe, forged session row, raw fact insert) plus three introspection reads (the live schema, the schema_version migration tracker, and the live RPC registry — the highest info-leak of the set were the gate to break). Their only structural fence is the daemon-token credential gate on each spec's auth axis. A test binary live-mounts them on its RPC endpoint but keeps them off the declared surface — so the spec-derived describe_rpc_attack_surface_tests never enumerates them, and nothing else fires them with a non-daemon credential to prove the gate holds end-to-end. This suite does, against each impl's real auth resolution.

For every backdoor method, three principals:

• anonymous (no credential) → 401 (pre-validation auth refuses an account-less caller before anything else).
• session (the keeper's browser-context cookie) → 403 credential_type_required — a session cookie, even one carrying the keeper role, tops out below the daemon-token channel.
• bearer (the keeper's api-token, non-browser context) → 403 credential_type_required — same ceiling; an api token cannot reach keeper operations.

Each method is sent with valid params so the session/bearer cases clear the dispatcher's input-validation (400) phase and actually reach the post-authorization credential gate (the order is 401 → 400 → 403); the handler never runs (the gate refuses first), so the writes never execute.

Complements the spec-level gate check (which pins that each spec *declares* credential_types: ['daemon_token']) and the surface-absence invariant (assert_no_testing_methods) — this one pins the runtime 401/403 behavior on both impls. Cited property: security.md §Test Backdoor Actions (daemon-token-gated, off-surface, DEV-excluded).

Cross-process only — the _testing_* actions are mounted on the spawned binary, not the in-process app — like the ws/sse suites. Wire from a *.cross.test.ts. Requires the standard _testing_* actions mounted (the same precondition default_cross_process_setup already imposes for its per-test _testing_reset); ungated, since every cross backend mounts them.

$lib-free by contract (relative specifiers only), like the sibling cross-backend suites.